Commit 19c2b8c
Fix TSA #2816220: suppress Flawfinder false positive on Cython read-loop iterator (#2032)
Flawfinder's buffer/read rule (CWE-120, CWE-20) fires whenever an
identifier named "read" appears inside a loop, assuming it refers to the
POSIX read() syscall. The Cython 3.x ModuleStateLookup boilerplate in
__Pyx_State_ConvertFromInterpIdAsIndex uses "read" as the name of a
pointer iterator that walks data->table, bounded by
end = read + data->count. There is no syscall and no unbounded buffer
access -- this is a false positive.
Add an inline /* Flawfinder: ignore */ annotation to the flagged line in
the Cython-generated pydevd_cython.c and extend the existing
post-processing block in setup_pydevd_cython.py so the annotation is
re-applied automatically whenever Cython regenerates the .c files.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>1 parent ab92638 commit 19c2b8c
1 file changed
Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
0 commit comments